Senior Exposure Management Analyst

This role is structured as an initial 12-Month FTC, before converting to a permanent role.

The position offers hybrid working (2 days p/w on-site) in either London, Manchester, Bristol, or Brighton - whichever location is nearest to you.

Role Summary

Support and enhance Continuous Threat Exposure Management (CTEM), identifying, assessing and prioritising vulnerabilities and driving remediation across the technology estate.

This hands-on role combines vulnerability management, cloud exposure assessment and risk-based prioritisation. You will turn findings from multiple security sources into clear actions, working with technical teams and business stakeholders to improve coverage, strengthen data quality and reduce risk.

Key Responsibilities

• Operate and improve vulnerability scanning processes, including authenticated and unauthenticated scans, agent deployment, coverage checks and validation of findings.
• Assess cloud exposures, identifying vulnerabilities, misconfigurations, ownership gaps and appropriate remediation actions.
• Consolidate and normalise security data to support accurate vulnerability records, ownership, remediation tracking, exception management and reporting.
• Correlate and deduplicate findings from vulnerability scans, penetration tests, breach and attack simulation, Red Team activity and cloud platforms.
• Prioritise exposures using severity, exploitability, threat intelligence, asset criticality, business impact and applicable requirements.
• Drive remediation with infrastructure, application, cloud, network and business teams, agreeing ownership, challenging blockers and tracking actions through to closure.
• Lead remediation reviews and stakeholder meetings, ensuring actions are understood and completed within agreed timescales.
• Produce dashboards, progress updates and evidence for operational teams, governance forums, audit and senior stakeholders.
• Identify recurring issues, coverage gaps and overdue actions, using data to improve processes and control effectiveness.
• Mentor colleagues and share knowledge through coaching, documentation, training and lessons learned.

Required Skills & Experience

• Strong hands-on experience in vulnerability and exposure management, including scan configuration, agent deployment, coverage troubleshooting and validation of findings.
• Practical cloud security experience, with an understanding of cloud assets, misconfigurations, vulnerabilities and remediation routes.
• Ability to interpret CVEs, CVSS scores, exploitability and threat intelligence to support risk-based prioritisation.
• Experience improving security data quality and correlating findings across multiple sources.
• Understanding of penetration testing, breach and attack simulation and Red Team findings.
• Strong stakeholder engagement skills, with experience influencing technical teams and business stakeholders to deliver remediation.
• Ability to explain technical risks clearly and translate findings into practical actions.
• Experience producing accurate reporting to support operational delivery, governance and decision-making.
• Experience mentoring colleagues and improving team capability.
• A proactive, organised approach, with the confidence to take ownership and follow complex issues through to resolution.